#WCTCS9 #币圈观察员 1011 Anniversary of $19 billion in liquidations!
On October 11 one year ago, the crypto market witnessed a single-day liquidation event that went down in industry history. Total liquidations across the network exceeded $19 billion, and Bitcoin fell 12.7% in half an hour.
Many market participants are still considering one question: before a black swan event occurs, there are often no obvious warning signals in the market. With hardware wallets continuously revealing security vulnerabilities and fake websites persistently targeting users, could such security incidents trigger market panic again, leading to a rapid rebound after a sharp plunge? Answering this question requires reviewing the underlying logic of the 1011 crash, distinguishing the different impacts of two types of risk events on the market, and objectively sorting through the market’s supporting factors and potential risks, without forecasting price movements or providing any investment advice.
I. Reviewing the 1011 Crash: An Extreme Market Move Driven by External News, Leverage, and Liquidity
On October 7, 2025, Bitcoin had just set a new all-time high of $126,080, while market sentiment was elevated and large amounts of long leverage had accumulated in the futures market. Just four days later, around 16:50 Beijing time on October 11, Bitcoin rapidly fell from approximately $116,900 to $102,000 within 30 minutes, a half-hour decline of 12.7%. Total liquidations across the network exceeded $19 billion that day, setting a record at the time.
This crash was not caused by a single factor.
First, external macroeconomic news triggered a collective sell-off in risk assets, causing market sentiment to quickly shift toward risk aversion.
Second, large numbers of long positions in the market were forcibly liquidated, with liquidation sell orders continuing to pressure the market and creating a cascading effect. Multiple trading platforms saw extreme price wicks. ATOM fell to a low of $0.001 on bn, while the same asset reached a low of $3.56 on Coinb; wBETH and BNSOL saw extremely low prices, and the stablecoin USDe briefly depegged to a low of $0.65.
After the event, bn paid approximately $283 million in total compensation to users affected by the price wicks.
Third, on-chain data showed that a whale on Hyperliquid established a Bitcoin short position worth approximately $400 million before the tariff news was released. The move prompted speculation within the industry about insider trading. Arkham labeled it the “Trump insider whale,” but people associated with the address, including Garrett Jin, denied any connection. The insider-trading allegations have not been confirmed to date. From the market’s price action, the 1011 crash was a short-term liquidity cascade caused by the combination of an external macroeconomic shock and a highly leveraged market structure. Such events are characterized by an extremely rapid decline. After leverage has been fully liquidated, selling pressure is quickly released, creating the possibility of a short-term recovery—what market participants describe as a rapid rebound after a sharp drop.
However, this market structure requires several conditions: the market must contain a large amount of highly leveraged long positions, unexpected news must directly shock market expectations, and short-term liquidity must quickly dry up. Without any one of these conditions, it would be difficult to reproduce a move of the same magnitude.
II. A Complete Review of the Facts Surrounding the Current Hardware Wallet Security Incidents
A series of recent hardware wallet-related security incidents has become the core trigger for market concerns about a new wave of panic selling.
Security researcher cyberscrilla discovered fake Ledger websites and fake apps appearing at the top of Google search results, intended to trick users into surrendering their 24-word recovery phrases. Google backend data showed that the fake website received more than 1 million visits in 30 days. Before that, Zscaler detected malicious Google ads in September disguised as official Ledger entry points that redirected users to fake wallet verification pages to steal their recovery phrases. In addition, Ledger is investigating a coin theft case related to Southeast Asian distributor CryptoBilis, involving an estimated $86 million. Ledger officially confirmed that some devices purchased from the distributor contained unauthorized hardware implants. Affected users purchased hardware wallets through CryptoBilis and had their assets stolen after completing initialization. Ledger’s investigation clearly concluded that there was no evidence that Ledger’s own infrastructure, backend systems, or official services had been hacked; the risk was concentrated in the circulation process involving the third-party distributor. After the incident, distributor CryptoBilis suspended sales of all hardware wallet inventory pending the conclusion of the investigation. Ledger issued corresponding user guidance: devices from this channel that have not yet been initialized should not be set up; users who have already completed initialization are advised to migrate their assets to a new Ledger signing device using a completely new recovery phrase. Ledger also reiterated that it will never request users’ 24-word recovery phrases through any channel. Any message requesting a recovery phrase is a scam, and users should obtain updates about the incident only through official channels.
The triggering logic of the hardware wallet theft incident is fundamentally different from that of the 1011 crash.
The 1011 incident was a macroeconomic shock to the valuation expectations of crypto assets as a whole, directly hitting trading positions across the entire market; the hardware wallet theft incident is a single-point risk at the asset storage security layer, mainly affecting users holding spot assets and using hardware wallets, and will not directly trigger large-scale cascading liquidations in the futures market.
III. Current Supporting Factors in the Market
First, technical analysis indicates key support levels recognized by the market.
Some analysts have compared historical market trends and believe that Bitcoin’s current movement resembles its movement from late 2025 to early 2026, with $80,500 serving as a key short-term support level. When the price approaches a key support level, some market funds may step in to absorb selling, helping to ease the intensity of a one-way decline.
Second, the hardware wallet incident is an isolated supply-chain issue, and the manufacturer has proactively taken action. The distributor has suspended sales, the official company has proactively contacted victims and coordinated with law enforcement to pursue the attackers, and it has simultaneously released an asset migration plan for users. After the incident, the manufacturer promptly disclosed the scope of the risk, helping users identify risky devices and reducing the spread of panic. Such public handling can reduce excessive market fear that “hardware wallets across the entire industry have collectively failed.”
Third, the market’s understanding of security incidents has improved.
After multiple security incidents over the past several years, the market is now able to distinguish among different types of risks, including exchange risks, protocol vulnerabilities, supply-chain tampering, and phishing website scams.
Users can distinguish that only devices from a specific distributor channel face the risk of hardware tampering, rather than all Ledger wallets
IV. Potential Negative Factors and Risks Associated with This Hardware Wallet Incident
First, a short-term shock to confidence.
Hardware wallets have long been defined by the industry as a secure solution for offline asset storage. Supply-chain hardware implant attacks have shattered the ingrained belief that “offline means absolutely safe.” Some spot holders may panic and choose to sell their assets to avoid risk, creating short-term selling pressure. If the media continues to spread news of the incident and amplifies panic, prices may experience a short-term pullback. Second, the risk of derivative scams is also increasing.
As the coin theft incident develops, hackers may exploit public panic by releasing large amounts of false information and forging official notices and fake asset migration links to continue stealing users’ recovery phrases. Such secondary scams will continue to erode confidence in the industry and further amplify negative sentiment.
Third, the risk may spread.
If subsequent investigations reveal more victims, the amount involved continues to expand, or similar supply-chain vulnerabilities are discovered at other hardware wallet manufacturers, market panic will intensify and trigger broader spot selling.
Fourth, external macroeconomic variables cannot be ignored. The core trigger of the 1011 crash was external macroeconomic news, while the hardware wallet incident can at most serve as a secondary catalyst. If the hardware wallet incident coincides with external macroeconomic negative factors, the resonance between the two types of negative factors will significantly amplify market volatility.
V. Comparing the Two Types of Black Swan Events and Determining the Core Boundaries for Repeating the Market Move
The 1011 crash was a combination of macroeconomic news and a highly leveraged futures cascade. It was a market-wide valuation shock characterized by an extremely rapid decline. After leverage was cleared out in a single wave, selling pressure was quickly released, creating the possibility of a V-shaped recovery.
The hardware wallet theft incident is a single-point asset storage security event, with its impact concentrated among spot holders and without the underlying conditions to directly trigger cascading futures liquidations.
Relying solely on a hardware wallet security incident, it would be difficult to reproduce a market move involving a 12.7% plunge in half an hour and tens of billions of dollars in liquidations across the network. A rapid rebound after a sharp decline may occur only if multiple conditions below are met simultaneously:
First, the incident continues to escalate, triggering concentrated selling of large amounts of spot assets;
Second, the market has already accumulated substantial long leverage, and spot selling pressure triggers cascading futures liquidations;
Third, external macroeconomic negative factors add to the shock;
Fourth, short-term market liquidity is insufficient.
Without the resonance of these multiple conditions, a hardware wallet security incident alone will most likely bring only short-term volatility or a modest pullback, rather than reproduce last year’s extreme flash crash.
VI. Possible Responses for Market ParticipantsCZ posted an emphasis on the core logic of asset allocation: users should reasonably divide their assets and diversify them between centralized platforms and personal self-custodial wallets based on their own holdings, technical capabilities, and usage needs. Self-custody requires individuals to assume full responsibility for safeguarding private keys and recovering assets, placing higher demands on their personal security practices; platform custody requires users to bear platform credit and counterparty risks. At the same time, maintaining an independent personal wallet can effectively avoid restrictions on asset access caused by platform maintenance or service interruptions, improving the security and stability of asset allocation.
From an objective asset security perspective, follow these feasible response measures.
First, distinguish the scope of the risk.
Distinguish supply-chain hardware tampering risks from phishing website scams, and do not expand the device risk of a single distributor to all hardware wallet products. Do not readily trust unverified rumors on social media; refer only to official hardware wallet announcements.
Second, strictly protect recovery phrases.
No official institution or wallet manufacturer will request a 24-word recovery phrase. Anyone requesting a recovery phrase is a scammer. When downloading wallet software through a search engine or visiting a wallet website, carefully verify the domain name and beware of fake links in search engine advertisements.
Third, check the hardware wallet purchase channel.
If the device was purchased from a third-party distributor, check the official announcement to determine whether it belongs to an affected batch and handle asset migration according to the official guidance. Devices purchased through official direct-sales channels are not involved in this incident.
Fourth, control the use of leverage.
The vast majority of the huge losses in the 1011 crash came from forced liquidations of leveraged futures positions. Leverage amplifies losses caused by price fluctuations, so when market uncertainty rises, the risks brought by leverage need to be fully assessed.
Fifth, develop multidimensional risk awareness.
There is no absolutely secure method of storing assets. Exchange custody, hot wallets, and hardware cold wallets each carry different risks. Asset security is a complete process, not something that can be fully guaranteed by relying on a single device. All hardware wallet products are not secure. At the same time, the market can distinguish phishing scams from underlying system breaches and will not simply equate a coin theft incident through a single channel with the collapse of security across the entire crypto asset system.
Fourth, after experiencing multiple extreme market moves, the crypto market’s leverage level will self-adjust.
After liquidations on the scale of 1011, market participants have become more aware of the risks of high leverage. Without sustained optimism driving leverage higher, it would be difficult to quickly accumulate long leverage on the same scale as the previous year, leaving insufficient conditions for large-scale cascading liquidations.
Conclusion
On the first anniversary of the 1011 crash, the market is once again facing negative security-related news, and many investors will instinctively associate it with last year’s flash crash. However, by breaking down the underlying logic of the two events, it becomes clear that their risk types, scopes of impact, and transmission paths are completely different. A hardware wallet supply-chain attack is a localized risk at the asset storage layer, while the 1011 crash was a systemic cascade formed by the combination of macroeconomic news, high leverage, and a liquidity crunch. Whether the market will experience a sharp decline followed by a rapid rebound depends on whether multiple conditions resonate, and there is no way to predict this in advance. Market participants need not panic excessively, but they should not ignore potential risks. The focus is not on guessing whether prices will rise or fall, but on identifying the boundaries of risk, protecting asset security, and rationally viewing the high volatility inherent in the crypto market.

#Ledger事件损失近9000万 Ledger has run into trouble again—what’s the safest way to store crypto? Can hardware wallets still be used, and how can assets be protected?
Over the past two years, it has been a particularly troubled time for hardware wallets. Every time something happens, people question: If hardware wallets can also be maliciously modified, why buy one at all? Wouldn’t it be better to just use a mobile wallet?
I strongly agree! I have always believed that hardware wallets are not suitable for everyone. Their core advantage lies in physically isolating private keys in a dedicated hardware environment, preventing everyday internet-connected computers and phones from easily accessing the private keys, while confirming transaction details through an independent screen. As a single-point defense, this remains an exceptionally robust design.
The problem is that many people treat them as “万能 safes,” believing that buying one means they can rest easy. For ordinary users, layered defense is more important:
1. An idle old phone as a cold wallet
If you have a retired iPhone or Android phone at home, completely erase its data, configure a reliable open-source offline signing tool, then keep it disconnected from the internet and use it as a dedicated signing device to build a cold wallet. This can also avoid targeted supply-chain attacks that may occur during the purchase and delivery of dedicated hardware wallets.
After all, when you buy a Ledger, SafePal, or OneKey, the product order, delivery information, and even shipping records may not necessarily mean you are a major holder, but they allow people with access to this information to know that you use crypto assets. An ordinary phone is different: If you take an iPhone outside, who would know whether you use it to watch videos or whether it contains BTC worth several million dollars?
Of course, phones themselves also carry risks from software vulnerabilities, device provenance, and hardware supply chains. Simply turning off Wi-Fi and enabling airplane mode does not automatically turn one into a qualified cold wallet.
What truly matters is a trustworthy software source, a strict offline signing process, and proper backup of the seed phrase.
2. Passphrase
Many hardware wallets support the BIP-39 Passphrase, commonly known as the “25th word.” Simply put, in addition to the original seed phrase, you set an additional password phrase known only to you, deriving another wallet from it. Thus, even if an attacker obtains the original seed phrase, they generally cannot recover the accounts protected by this additional layer without knowing the Passphrase.
However, considering the attack method involved this time, a problem arises. If a malicious module can steal the seed phrase displayed on the screen, it can very likely record the Passphrase input process as well, not to mention that the Passphrase itself introduces additional backup and recovery risks. Getting even one character wrong could make the assets unrecoverable.
Therefore, my view is that Passphrase can be used, especially by long-term holders with a certain level of technical knowledge, but only after understanding how it works and then deciding whether to add this layer of complexity.
3. A multisig setup using multiple brands and devices
Given this kind of hardware-tampering-level risk, after considering all the options, multisig is almost the only ultimate solution.
For example, set up a 2-of-3 multisig and purchase three hardware wallets from different brands to manage the same assets. Transfers would require authorization from two signatures. Since the devices come from different manufacturers and procurement channels, this directly eliminates the single-point failure risk of relying on one brand and one supply chain.
Even if a hacker physically compromises one of the devices and obtains one private key, they still cannot transfer your funds.
Of course, multisig has a higher barrier to entry. Implementation varies across different chains and also involves smart contracts and complex backup mechanisms. A security strategy is not necessarily better simply because it has more layers. It must match the size of your assets and your practical capabilities. Do not get yourself tangled up in pursuit of maximum security and end up unable to recover your assets.
Ultimately, I have always preferred “layered custody”:
Small, frequent transactions: keep them directly in a hot wallet for convenience;
Daily trading and liquidity: keep them on a Top2 exchange. To be blunt, for many beginners, the risk controls and technical defenses of leading exchanges are far safer than blindly tinkering with cold wallets themselves;
Large long-term holdings that will remain untouched: use a cold wallet shipped directly by the official source, or configure multisig and Passphrase for segregated storage;
In summary, there is only one principle: Never bet your entire net worth on a single manufacturer or a single link in the process. This suspected Ledger supply-chain attack also serves as a reminder: The security of a hardware wallet is not limited to the chip and firmware themselves; it also includes the entire circulation process from the factory to the user. Once a device leaves the original manufacturer and passes through third-party warehousing or personal intermediaries, the risk of physical tampering, such as disassembly or the insertion of malicious modules, may increase. Even if the device passes official authenticity verification, that does not necessarily mean it has not been tampered with. #WCTCS9